<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<div>Unfortunately that's not completely correct.</div>
<div><br>
</div>
You can not only check but also generate a correct authentication with the unencrypted HASH values.
<div><br>
</div>
<div>So the storing HA1 and HA1_2 in the DB is no better than storing the password in DB. The only difference is that HA1 and HA1_2 don't reveal the underlying password.</div>
<div><br>
</div>
<div>If someone has access to your DB that someone can use the HA1 and HA1_2 values to authenticate correctly against you system and make fraudulent calls.</div>
<div><br>
</div>
<div>Which is why I also call the HASH values "unencrypted".</div>
<div><br>
</div>
<div>Regards,</div>
<div><br>
</div>
<div>Marc<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF826603" style="direction: ltr;"><font face="Tahoma" size="2" color="#000000"><b>From:</b> Spce-user [spce-user-bounces@lists.sipwise.com] on behalf of Raúl Alexis Betancor Santana [rabs@dimension-virtual.com]<br>
<b>Sent:</b> Thursday, April 30, 2015 18:11<br>
<b>To:</b> <spce-user@lists.sipwise.com><br>
<b>Subject:</b> Re: [Spce-user] Hide customer password in Kamailio DB<br>
</font><br>
</div>
<div></div>
<div>
<div style="font-family:arial,helvetica,sans-serif; font-size:12pt; color:#000000">
<div>Marc,</div>
<div><br>
</div>
<div>HA1 and HA1_2 are not 'unencrypted' text ... they are HASH values, generated from the user URI, the REALM and the PASSWORD ... your could not use the HA1 and HA1_2 values for anything than 'check' if the sended (by the SIP UA) credentials are Ok, you could
not use them to 'know' the unencrypted password.</div>
<div><br>
</div>
<div>Best regards</div>
<div><br>
</div>
<hr id="zwchr">
<div>
<blockquote style="border-left:2px solid #1010FF; margin-left:5px; padding-left:5px; color:#000; font-weight:normal; font-style:normal; text-decoration:none; font-family:Helvetica,Arial,sans-serif; font-size:12pt">
<b>De: </b>"Marc Storck" <mstorck@voipgate.com><br>
<b>Para: </b>"<spce-user@lists.sipwise.com>" <spce-user@lists.sipwise.com><br>
<b>Enviados: </b>Jueves, 30 de Abril 2015 12:57:35<br>
<b>Asunto: </b>Re: [Spce-user] Hide customer password in Kamailio DB<br>
</blockquote>
</div>
<div>
<blockquote style="border-left:2px solid #1010FF; margin-left:5px; padding-left:5px; color:#000; font-weight:normal; font-style:normal; text-decoration:none; font-family:Helvetica,Arial,sans-serif; font-size:12pt">
What is the difference from reading the plain text (unencrypted) password or reading the plain text (unencrypted) HA1 and HA1_2 values from DB?
<div class=""><br class="">
</div>
<div class="">AFAIK, an attacker, who was able to read either of them from your DB, can use those values to correctly authenticate to the SPCE in any case.</div>
<div class=""> <br class="">
<div>
<blockquote class="">
<div class="">On 30 Apr 2015, at 13:45, Mathys Frédéric <<a href="mailto:frederic.mathys@nagra.com" class="" target="_blank">frederic.mathys@nagra.com</a>> wrote:</div>
<div class="">
<div class="WordSection1" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
Hello,</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
When creating a new user, by default the password is saved in plaintext in the DB, column “password”. For obvious security reasons, I’d like to remove the password in this column and use only ha1 and ha1b values. To do that, I modified the “auth_db” module
configuration :</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span lang="FR-CH" class="">/etc/kamailio/proxy/kamailio.cfg</span></div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
modparam("auth_db", "use_domain", 1)</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
modparam("auth_db", "calculate_ha1", 0)</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
modparam("auth_db", "password_column", "ha1")</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
modparam("auth_db", "password_column_2", "ha1_2")</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
Then, I removed the password for all users in the DB, and everyone seems able to connect with this configuration. My problem is now when I create a new user, the password is automatically saved in plaintext and I don’t want that. So I tried to modify “kamctlrc”
by adding the following line :</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
/etc/kamailio/proxy/kamctlrc and /etc/kamailio/lb/kamctlrc</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
STORE_PLAINTEXT_PW=0</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
This has no effect, what should I do to disable that?</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
Thank you</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
</div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span class="" style="font-size:10pt">Frederic Mathys</span></div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span class="" style="font-size:10pt">System Integration & Validation Engineer</span></div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
<span lang="FR" class="" style="font-size:18pt; font-family:Webdings; color:green">P</span><span lang="FR" class="" style="font-size:8pt; font-family:Helvetica,sans-serif"> </span><span class="" style="font-size:8pt; color:green">Please consider the environment
- do you really need to print this email ?</span><span class="" style="font-size:10pt; font-family:Arial,sans-serif"></span></div>
<div class="" style="margin:0cm 0cm 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif">
</div>
</div>
<span class="" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; float:none; display:inline!important">_______________________________________________</span><br class="" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<span class="" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; float:none; display:inline!important">Spce-user
mailing list</span><br class="" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<a href="mailto:Spce-user@lists.sipwise.com" class="" style="color:purple; text-decoration:underline; font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px" target="_blank">Spce-user@lists.sipwise.com</a><br class="" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<a href="https://lists.sipwise.com/listinfo/spce-user" class="" style="color:purple; text-decoration:underline; font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px" target="_blank">https://lists.sipwise.com/listinfo/spce-user</a></div>
</blockquote>
</div>
<br class="">
</div>
<br>
_______________________________________________<br>
Spce-user mailing list<br>
Spce-user@lists.sipwise.com<br>
https://lists.sipwise.com/listinfo/spce-user<br>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>